[December-13-2025] Daily Cybersecurity Threat Report

This report details a series of recent cyber incidents, providing key information for each event, including published URLs and associated screenshots, strictly based on the provided data.

Category: Initial Access
Content: The group claims to have leaked the login credentials to Sripatum University
Date: 2025-12-13T23:45:31Z
Network: telegram
Published URL: https://t.me/Zaher_Infinity/115 Screenshots: https://d34iuop8pidsy8.cloudfront.net/c743cb2e-4642-4f00-a3a6-c40b8a8d6212.png
Threat Actors: ZAHER INFINITY
Victim Country: Thailand
Victim Industry: Education
Victim Organization: sripatum university
Victim Site: studentscms.spu.ac.th

2. Alleged sale of French data

Category: Data Breach
Content: Threat actor claims to have leaked French data
Date: 2025-12-13T22:59:21Z
Network: openweb
Published URL: https://leakbase.la/threads/fftir-murfy-and-160-others-fr-data.47097/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/c7b1e9f2-d8e9-4ef1-873e-a3bf0dddf55f.png
Threat Actors: aaronweb
Victim Country: France
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

3. Alleged data breach of PureJewels

Category: Data Breach
Content: The threat actor claims to be leaked a data from PureJewels. The exposed information reportedly includes customer details such as email addresses, first and last names, newsletter subscription status, user agents, and hashed passwords, suggesting a compromise of customer account or marketing database data.
Date: 2025-12-13T22:23:30Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-purejewels-com-Display-and-sell-luxury-jewelry-online-in-the-UK Screenshots: https://d34iuop8pidsy8.cloudfront.net/996766c1-971a-48de-81e6-615c5caebb08.png
Threat Actors: crazyboy68
Victim Country: UK
Victim Industry: Luxury Goods & Jewelry
Victim Organization: purejewels
Victim Site: purejewels.com

Category: Initial Access
Content: The group claims to have leaked the login credentials of KidDiary School-
Date: 2025-12-13T21:34:17Z
Network: telegram
Published URL: https://t.me/black_bulletttt/630 Screenshots: https://d34iuop8pidsy8.cloudfront.net/3e312e20-b9bb-44a0-8856-97f5dd268fd7.png
Threat Actors: Black Bullet
Victim Country: Thailand
Victim Industry: Education
Victim Organization: kiddiary school
Victim Site: school.kiddiary.in.th

5. Alleged sale of unauthorized admin access to an Evolt Technology Co,Ltd.

Category: Initial Access
Content: The Threat actor claims to selling unauthorized admin access to an Evolt Technology Co,Ltd in thailand.
Date: 2025-12-13T20:49:51Z
Network: telegram
Published URL: https://t.me/black_bulletttt/649 Screenshots: https://d34iuop8pidsy8.cloudfront.net/9e348b88-44d4-4bab-9807-a5cd7efa8d12.png
Threat Actors: Black Bullet
Victim Country: Thailand
Victim Industry: Electrical & Electronic Manufacturing
Victim Organization: evolt technology co,ltd
Victim Site: partner.evolt.co.th

Category: Initial Access
Content: AECMobile.co.th is the website and service name for Blue Fin Co., Ltd.
Date: 2025-12-13T20:38:14Z
Network: telegram
Published URL: https://t.me/black_bulletttt/629 Screenshots: https://d34iuop8pidsy8.cloudfront.net/4c67f4a0-7bf2-4d40-94ef-d0a825093c7e.png
Threat Actors: Black Bullet
Victim Country: Thailand
Victim Industry: Software
Victim Organization: blue fin co., ltd.
Victim Site: aecmobile.co.th

7. Alleged leak of unauthorized access to Hartsfield-Jackson Atlanta International Airport

Category: Initial Access
Content: The group claims to have gained unauthorized access to Hartsfield-Jackson Atlanta International Airport
Date: 2025-12-13T20:33:22Z
Network: telegram
Published URL: https://t.me/zpentestalliance/844 Screenshots: https://d34iuop8pidsy8.cloudfront.net/5dc7b079-6119-46c0-bf7a-231e84c291b9.png https://d34iuop8pidsy8.cloudfront.net/d49066a1-398c-4171-97ba-2f0744926322.png
Threat Actors: Z-PENTEST ALLIANCE
Victim Country: USA
Victim Industry: Airlines & Aviation
Victim Organization: hartsfield-jackson atlanta international airport
Victim Site: atl.com

8. Alleged unauthorized access to DTCUltimate

Category: Initial Access
Content: The Group claims to have unauthorized access to DTCUltimate.
Date: 2025-12-13T20:23:16Z
Network: telegram
Published URL: https://t.me/black_bulletttt/632 Screenshots: https://d34iuop8pidsy8.cloudfront.net/5b302fac-b953-43fc-99dd-2df861363301.png
Threat Actors: Black Bullet
Victim Country: Thailand
Victim Industry: Transportation & Logistics
Victim Organization: d.t.c. enterprise public company limited
Victim Site: dtc.co.th

9. Alleged data breach of Israel Car Rental Guide

Category: Data Breach
Content: The group claims to have leaked a dataset containing vehicle information from Israel, totaling over 1 million records. The exposed data reportedly includes license plate numbers, vehicle models and types, brand details, engine model, manufacturing year, safety ratings, pollution group classifications, and related vehicle attributes.
Date: 2025-12-13T20:07:48Z
Network: telegram
Published URL: https://t.me/topsecretdocumentsleaked/145 Screenshots: https://d34iuop8pidsy8.cloudfront.net/38469243-0038-480b-bd94-5af59ecd9af9.png
Threat Actors: JRINTEL FREE DATA V3
Victim Country: Israel
Victim Industry: Government & Public Sector
Victim Organization: israel car rental guide
Victim Site: israelcar.net

10. Alleged sale of multiple WordPress credentials

Category: Initial Access
Content: The threat actor claims to be selling a collection of 18,867 WordPress wp-admin access credentials.
Date: 2025-12-13T19:28:50Z
Network: tor
Published URL: https://exploitivzcm5dawzhe6c32bbylyggbjvh5dyvsvb5lkuz5ptmunkmqd.onion/topic/272006/ Screenshots: https://d34iuop8pidsy8.cloudfront.net/c886be6c-ca78-42ce-b8d2-669ad6271201.png
Threat Actors: Bosota_Corporate
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

11. Alleged data breach of Burapha University

Category: Data Breach
Content: The threat actor claims to have breached organization’s data.
Date: 2025-12-13T19:15:11Z
Network: telegram
Published URL: https://t.me/black_bulletttt/627 Screenshots: https://d34iuop8pidsy8.cloudfront.net/3f891745-8401-44cc-a8a9-c2863eba5ad8.png
Threat Actors: Black Bullet
Victim Country: Thailand
Victim Industry: Education
Victim Organization: burapha university
Victim Site: angsila.cs.buu.ac.th

12. Alleged sale of Italian Citizens data

Category: Data Breach
Content: The threat actor claims to have leaked a database containing approximately 362,956 records of Italian citizens. The exposed data reportedly includes full names, dates of birth, phone numbers, gender information, and residential address details such as city and street.
Date: 2025-12-13T19:08:08Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-ITALY-DATABASE-362k-rows Screenshots: https://d34iuop8pidsy8.cloudfront.net/2b68f052-517c-47eb-ae78-ca0662335e14.png
Threat Actors: socializer
Victim Country: Italy
Victim Industry: Government & Public Sector
Victim Organization: Unknown
Victim Site: Unknown

Category: Initial Access
Content: The group claims to have leaked the login credentials of Departmental Personnel Information System, Ministry of Interior Thailand.
Date: 2025-12-13T19:00:41Z
Network: telegram
Published URL: https://t.me/black_bulletttt/623 Screenshots: https://d34iuop8pidsy8.cloudfront.net/7fbf366e-0d69-4ed1-b5d6-6cfba567f67b.png
Threat Actors: Black Bullet
Victim Country: Thailand
Victim Industry: Government Administration
Victim Organization: ministry of interior
Victim Site: dpis.moi.go.th

14. Alleged data breach of Vivek Vidyalaya & Junior College

Category: Data Breach
Content: The group claims to have obtained organisation data.
Date: 2025-12-13T18:08:11Z
Network: telegram
Published URL: https://t.me/DIeNlt/771 Screenshots: https://d34iuop8pidsy8.cloudfront.net/acd016d7-9798-45fb-b67c-8c7a2f1d45aa.png
Threat Actors: DieNet
Victim Country: India
Victim Industry: Education
Victim Organization: vivek vidyalaya & junior college
Victim Site: vivekvidyalaya.org

15. Vishnick McGovern Milizio LLP falls victim to Qilin Ransomware

Category: Ransomware
Content: The group claims to have obtained organization’s data.
Date: 2025-12-13T18:04:18Z
Network: tor
Published URL: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=af5b143b-5318-3250-8724-49288dc9c5ed Screenshots: https://d34iuop8pidsy8.cloudfront.net/b640b87d-d860-4ef5-b1b7-6d4503c7f0b5.png https://d34iuop8pidsy8.cloudfront.net/b439628a-ce4c-412b-a58b-bace9b1021dc.png https://d34iuop8pidsy8.cloudfront.net/77d2a0ba-b9f9-424d-b38d-5e167c2d6284.png
Threat Actors: Qilin
Victim Country: USA
Victim Industry: Legal Services
Victim Organization: vishnick mcgovern milizio llp
Victim Site: vmmlegal.com

16. Eastman Cooke & Associates falls victim to PLAY Ransomware

Category: Ransomware
Content: Group claims to have obtained organizational internal data. Private and personal confidential data, clients information, finance information and they indent to publish it within 4 days.
Date: 2025-12-13T17:43:59Z
Network: tor
Published URL: http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=OrH11WbYbRcPNd Screenshots: https://d34iuop8pidsy8.cloudfront.net/a65d2379-b8ea-4a65-9eeb-f48a3aec97da.png
Threat Actors: PLAY
Victim Country: USA
Victim Industry: Building and construction
Victim Organization: eastman cooke & associates
Victim Site: eastmancooke.com

17. Viga Eatery & Catering falls victim to PLAY Ransomware

Category: Ransomware
Content: Group claims to have obtained organizational internal data. Private and personal confidential data, clients information, finance information and they indent to publish it within 4 days.
Date: 2025-12-13T17:37:40Z
Network: tor
Published URL: http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=uy511cnq9pLaq6Screenshots:https://d34iuop8pidsy8.cloudfront.net/bbb7c156-205e-48f8-8b92-b60ccf413612.png
Threat Actors: PLAY
Victim Country: USA
Victim Industry: Food & Beverages
Victim Organization: viga eatery & catering
Victim Site: vigaeatery.com

18. Alleged leak of unauthorized access to Student Care

Category: Initial Access
Content: The threat actor claims to have leaked unauthorized access to Student Care
Date: 2025-12-13T17:32:20Z
Network: telegram
Published URL: https://t.me/zeroblueshadow/370Screenshots:https://d34iuop8pidsy8.cloudfront.net/90f6826c-3ff3-4d33-88b2-5afe97cad802.png
Threat Actors: Blue Shadow
Victim Country: Thailand
Victim Industry: Software Development
Victim Organization: student care
Victim Site: student.co.th

19. Alleged leak of login credentials to Contributor Platform – KMUTT

Category: Initial Access
Content: The group claims to have leaked login credentials to the Contributor Platform – KMUTT.
Date: 2025-12-13T17:31:49Z
Network: telegram
Published URL: https://t.me/zeroblueshadow/366Screenshots:https://d34iuop8pidsy8.cloudfront.net/3e00a11b-5b84-4cde-817e-89cd642dd8d9.png
Threat Actors: Blue Shadow
Victim Country: Thailand
Victim Industry: Higher Education/Acadamia
Victim Organization: contributor platform – kmutt.
Victim Site: contributor.lib.kmutt.ac.th

20. Alleged leak of unauthorized access to Ramkhamhaeng University (e-Services portal)

Category: Initial Access
Content: The threat actor claims to have leaked unauthorized access to Ramkhamhaeng University (e-Services portal)
Date: 2025-12-13T17:25:15Z
Network: telegram
Published URL: https://t.me/zeroblueshadow/370Screenshots:https://d34iuop8pidsy8.cloudfront.net/51f47ad7-773c-4853-9832-8a0017d66139.png
Threat Actors: Blue Shadow
Victim Country: Thailand
Victim Industry: Education
Victim Organization: ramkhamhaeng university (e-services portal)
Victim Site: beta-e-service.ru.ac.th

21. Alleged data breach of D Prime

Category: Data Breach
Content: The threat actor claims to have breached the organization’s data.
Date: 2025-12-13T17:07:57Z
Network: telegram
Published URL: https://t.me/c/2273625312/3064Screenshots:https://d34iuop8pidsy8.cloudfront.net/af5da2c5-2588-4746-8ded-dcec054fcc55.png
Threat Actors: Yiqun data
Victim Country: China
Victim Industry: Financial Services
Victim Organization: d prime
Victim Site: dooprime.com

22. Alleged data breach of TradingBlock

Category: Data Breach
Content: The group claims to have breached the organization’s data.
Date: 2025-12-13T16:53:58Z
Network: telegram
Published URL: https://t.me/c/2273625312/3059Screenshots:https://d34iuop8pidsy8.cloudfront.net/e4d6505b-4936-4297-8deb-689970b3d2f3.png
Threat Actors: Yiqun data
Victim Country: USA
Victim Industry: Financial Services
Victim Organization: tradingblock
Victim Site: tradingblock.com

23. Choate’s Air Conditioning, Heating, Plumbing and Electrical falls victim to PLAY Ransomware

Category: Ransomware
Content: Group claims to have obtained organizational internal data. Private and personal confidential data, clients information, finance information and they indent to publish it within 4 days.
Date: 2025-12-13T16:52:55Z
Network: tor
Published URL: http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=nDxM4bfecg1khtScreenshots:https://d34iuop8pidsy8.cloudfront.net/dff0324c-0280-4fa0-aadd-d31ea34cedd0.png
Threat Actors: PLAY
Victim Country: USA
Victim Industry: Consumer Services
Victim Organization: choate’s air conditioning, heating, plumbing and electrical
Victim Site: choateshvac.com

24. Jabezco Industrial Group, Inc. falls victim to PLAY Ransomware

Category: Ransomware
Content: Group claims to have obtained organizational internal data. The data contains Private and personal confidential data, clients information, finance information and they indent to publish it within 4 days.
Date: 2025-12-13T16:34:04Z
Network: tor
Published URL: http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion/topic.php?id=3M6JyDJunIl3PScreenshots:https://d34iuop8pidsy8.cloudfront.net/8e0feb2d-4a0d-456f-8e28-da7a96905f65.png
Threat Actors: PLAY
Victim Country: USA
Victim Industry: Building and construction
Victim Organization: jabezco industrial group, inc.
Victim Site: jabezco.com

25. CINVESTAV falls victim to Qilin Ransomware

Category: Ransomware
Content: The group clams to have obtained organization’s data.
Date: 2025-12-13T16:03:16Z
Network: tor
Published URL: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=05f326b3-8211-32f4-8388-aae644b16c8fScreenshots:https://d34iuop8pidsy8.cloudfront.net/dbc5eb3f-7a82-420d-b234-91981d597471.png
Threat Actors: Qilin
Victim Country: Mexico
Victim Industry: Research Industry
Victim Organization: cinvestav
Victim Site: cinvestav.mx

26. Alleged data breach of United Bank

Category: Data Breach
Content: The threat actor claims to have breached the organization’s data.
Date: 2025-12-13T15:57:10Z
Network: telegram
Published URL: https://t.me/c/2273625312/3058Screenshots:https://d34iuop8pidsy8.cloudfront.net/5a6638e4-fae1-4984-a60d-ba0748165700.png
Threat Actors: Yiqun data
Victim Country: USA
Victim Industry: Financial Services
Victim Organization: united bank
Victim Site: bankwithunited.com

27. Alleged leak of access to the login portal for the Budget Bureau

Category: Initial Access
Content: The group claims to have leaked login credentials to the Budget Bureau.
Date: 2025-12-13T15:52:45Z
Network: telegram
Published URL: https://t.me/zeroblueshadow/365Screenshots:https://d34iuop8pidsy8.cloudfront.net/33560843-a15a-4644-bd1a-28010727c125.png
Threat Actors: Blue Shadow
Victim Country: Thailand
Victim Industry: Government Relations
Victim Organization: budget bureau
Victim Site: virtualbb.bb.go.th

28. Shamrock Technologies falls victim to MEDUSA Ransomware

Category: Ransomware
Content: The group claims to have obtained the organization’s internal data and intends to publish it within 22-23 days.
Date: 2025-12-13T15:32:02Z
Network: tor
Published URL: http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/detail?id=4dc305b1606aa24d8abb8a75b05edf37Screenshots:https://d34iuop8pidsy8.cloudfront.net/67a65d02-e6fb-4c69-8727-0067c85625cc.png https://d34iuop8pidsy8.cloudfront.net/e3ab10b0-c467-478f-a13a-22f4a81b172d.png https://d34iuop8pidsy8.cloudfront.net/f7f919ea-9983-4487-ae20-959e64716d67.png https://d34iuop8pidsy8.cloudfront.net/6b3090ca-f8ea-4c02-8726-645e76ae72b8.png https://d34iuop8pidsy8.cloudfront.net/69e4a3e9-e1f1-486b-9f4c-a0da1b12b506.png
Threat Actors: MEDUSA
Victim Country: USA
Victim Industry: Chemical Manufacturing
Victim Organization: shamrock technologies
Victim Site: shamrocktechnologies.com

29. PT Sampoerna Agro Tbk falls victim to MEDUSA Ransomware

Category: Ransomware
Content: The group claims to have obtained the organization’s internal data and intends to publish it within 19-20 days. NB: The organization had previously fallen victim on 28/08/24.
Date: 2025-12-13T15:20:40Z
Network: tor
Published URL: http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/detail?id=2f35c0cf1d2d0eae4048611a97fc8ad2Screenshots:https://d34iuop8pidsy8.cloudfront.net/99e6cb0e-467b-4222-b19f-f2ee2bfaef1a.png https://d34iuop8pidsy8.cloudfront.net/ec875f02-1aa6-4886-8ab2-5ea941967b0b.png https://d34iuop8pidsy8.cloudfront.net/1429fc02-a2f4-4fe8-873a-a13c7fb7a257.png https://d34iuop8pidsy8.cloudfront.net/b9fb5374-f3e7-4f54-a0bc-05e68c7b92f3.png
Threat Actors: MEDUSA
Victim Country: Indonesia
Victim Industry: Farming
Victim Organization: pt sampoerna agro tbk
Victim Site: sampoernaagro.com

30. Thunder Bay Counselling falls victim to MEDUSA Ransomware

Category: Ransomware
Content: The group claims to have obtained the organization’s internal data and they intend to publish it within 11-12 days.
Date: 2025-12-13T14:57:40Z
Network: tor
Published URL: http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/detail?id=ac93272130172860ea2780db5f6e3306Screenshots:https://d34iuop8pidsy8.cloudfront.net/2c91eef4-3d82-4e59-a824-8fa04ecf86e3.png https://d34iuop8pidsy8.cloudfront.net/527ae716-bef4-4ed5-898c-340ad17751b9.png https://d34iuop8pidsy8.cloudfront.net/b1b49252-619e-4323-90f3-ae36731ca740.png https://d34iuop8pidsy8.cloudfront.net/31b90b45-c95e-47ba-bae5-5dfb9bcc4d58.png https://d34iuop8pidsy8.cloudfront.net/d96221d0-f43a-4436-b435-47bd17b07d16.png
Threat Actors: MEDUSA
Victim Country: Canada
Victim Industry: Mental Health Care
Victim Organization: thunder bay counselling
Victim Site: tbaycounselling.com

31. Alleged Data Breach of Northern College

Category: Data Breach
Content: The threat actor claims to have leaked 318,000 records from Northern College. The compromised data reportedly includes names, phone numbers, email addresses, years, addresses, and more.
Date: 2025-12-13T14:46:45Z
Network: openweb
Published URL: https://darkforums.hn/Thread-DATABASE-northern-ac-th-Thailand-%D9%8FSQL-line-318KScreenshots:https://d34iuop8pidsy8.cloudfront.net/b67f9d26-f260-4921-acef-8c40a6177ecf.png
Threat Actors: RainbowDF
Victim Country: Thailand
Victim Industry: Education
Victim Organization: northern college
Victim Site: northern.ac.th

32. Alleged data breach of State Aviation Service of Ukraine

Category: Data Breach
Content: The group claims to have leaked data from the State Aviation Administration of Ukraine, specifically documents related to the company ANTONOV. The compromised data reportedly includes aircraft loading and centering instructions, technical operation manuals, aircraft maintenance documentation, training programs, flight data recording system (FDR) parameter tables, maintenance and inspection reports, aircraft operator instructions, airworthiness management forms, parts and power plant catalogs, and technical journals related to aircraft onboard equipment.
Date: 2025-12-13T14:22:06Z
Network: telegram
Published URL: https://t.me/c/3076265882/59Screenshots:https://d34iuop8pidsy8.cloudfront.net/0abe35b2-2cba-41a7-a818-e896dd8f3c0e.png https://d34iuop8pidsy8.cloudfront.net/55615c3f-93d4-4b5a-9cbd-385fbb47d5ea.png
Threat Actors: Dark Warios
Victim Country: Ukraine
Victim Industry: Government Administration
Victim Organization: state aviation service of ukraine
Victim Site: avia.gov.ua

33. Alleged sale of unauthorized access to HOTELCUBE WOW

Category: Initial Access
Content: The threat actor claims to be selling unauthorized FTP Access and Documents HOTELCUBE WOW.
Date: 2025-12-13T14:21:38Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-hotelcube-eu-FTP-Access-DocumentsScreenshots:https://d34iuop8pidsy8.cloudfront.net/6fe64625-b32f-4660-ba0b-65743731efb5.png
Threat Actors: phanes
Victim Country: Italy
Victim Industry: Hospitality & Tourism
Victim Organization: hotelcube wow
Victim Site: hotelcube.eu

34. 0xteam targets the website of The Change Portal

Category: Defacement
Content: The group claims to have defaced the website of The Change Portal, attributing the attack to its member, Chinafans.
Date: 2025-12-13T14:20:20Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216698Screenshots:https://d34iuop8pidsy8.cloudfront.net/a369785f-f0a4-40c2-9de7-0d6d91231b39.png
Threat Actors: 0xteam
Victim Country: USA
Victim Industry: Management Consulting
Victim Organization: the change portal
Victim Site: thechangeportal.com

35. NOTRASEC TEAM targets the website of Villa Prespa

Category: Defacement
Content: The group claims to have defaced the website of Villa Prespa.
Date: 2025-12-13T14:16:06Z
Network: telegram
Published URL: https://t.me/c/2622575053/1052Screenshots:https://d34iuop8pidsy8.cloudfront.net/f846badb-3a7d-47e3-ab33-a1c8f5129c25.png
Threat Actors: NOTRASEC TEAM
Victim Country: North Macedonia
Victim Industry: Hospitality & Tourism
Victim Organization: villa prespa
Victim Site: villaprespa.com

36. Alleged leak of Italy data

Category: Data Breach
Content: The threat actor claims to have leaked 362K rows of data from Italy, allegedly containing full names, dates of birth, phone numbers, genders, cities, and streets.
Date: 2025-12-13T14:11:12Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-ITALY-DATABASE-362k-rowsScreenshots:https://d34iuop8pidsy8.cloudfront.net/161771b8-eeb4-401e-8ce7-532f28c315c0.png
Threat Actors: socializer
Victim Country: Italy
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

37. chinafans targets the website of VIP Container

Category: Defacement
Content: The group claims to have defaced the website of VIP Container
Date: 2025-12-13T13:53:02Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216697Screenshots:https://d34iuop8pidsy8.cloudfront.net/c76d25f1-c1f7-40bd-9a07-e708383481a5.JPG
Threat Actors: chinafans
Victim Country: Iran
Victim Industry: Warehousing
Victim Organization: vip container
Victim Site: kantinrivip.org

38. Alleged data breach of DIF Baja California

Category: Data Breach
Content: The threat actor claims to have leaked a database from DIF Baja California (DIFBC) in Mexico, containing sensitive information like corporate credentials, executive details, employee records, and financial filings, categorized into various sectors.
Date: 2025-12-13T13:50:40Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Document-MX-GOB-DIF-Baja-California-DIFBC-FULL-DATAScreenshots:https://d34iuop8pidsy8.cloudfront.net/3857fddc-a763-4b65-87b0-66397554b367.png
Threat Actors: Evorax
Victim Country: Mexico
Victim Industry: Professional Services
Victim Organization: dif baja california
Victim Site: difbc.gob.mx

39. Alleged data breach of Turing

Category: Data Breach
Content: The threat actor claims to have data from Turing.com. allegedly containing email, username,password,first name,last name and more.
Date: 2025-12-13T13:45:30Z
Network: openweb
Published URL: https://xss.pro/threads/144787/Screenshots:https://d34iuop8pidsy8.cloudfront.net/00626835-7a08-431e-974c-289ffe9e6fde.png
Threat Actors: imlevi
Victim Country: USA
Victim Industry: Information Technology (IT) Services
Victim Organization: turing
Victim Site: turing.com

40. Alleged sale of unauthorized access to Sweco

Category: Initial Access
Content: Threat actor claims to be selling unauthorized FTP access to Sweco.
Date: 2025-12-13T13:44:35Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-sweco-se-FTP-Access-DocumentsScreenshots:https://d34iuop8pidsy8.cloudfront.net/b6cb4ec8-e854-4767-93d6-3bda5ff976c5.png
Threat Actors: phanes
Victim Country: Sweden
Victim Industry: Professional Services
Victim Organization: sweco
Victim Site: swecogroup.com

41. Alleged data leak of Allen Prep

Category: Data Breach
Content: Threat actor claims to have leaked data from Allen Prep. The compromised data reportedly contain 400K records, including email, password, name, username, etc.
Date: 2025-12-13T13:32:57Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-Free-Exam-Preparation-Questions-allenprep-com-Database-400K-USAScreenshots:https://d34iuop8pidsy8.cloudfront.net/c9b7cbbe-5991-4542-8f05-24a5d04682d6.png https://d34iuop8pidsy8.cloudfront.net/396c3408-cb5e-4ad0-b921-50a06f6ccaa1.png
Threat Actors: RainbowDF
Victim Country: USA
Victim Industry: Education
Victim Organization: allen prep
Victim Site: allenprep.com

42. LolForum targets the website of Trainer.crm

Category: Defacement
Content: The group claims to have defaced the website of Trainer.crm, Attributing the attack to its member fenxzdigital
Date: 2025-12-13T13:28:02Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216323Screenshots:https://d34iuop8pidsy8.cloudfront.net/aeb12736-d36e-4893-addd-dae925718fec.JPG
Threat Actors: LolForum
Victim Country: UK
Victim Industry: Software
Victim Organization: trainer.crm
Victim Site: trainercrm.com

43. Alleged data breach of International Trade Promotion (DITP)

Category: Data Breach
Content: The group claims to have breached data from Department of International Trade Promotion (DITP).
Date: 2025-12-13T13:19:48Z
Network: telegram
Published URL: https://t.me/Bl4ckCyb3r2/13Screenshots:https://d34iuop8pidsy8.cloudfront.net/4824bbb6-de80-4800-9079-5d0db7219163.png https://d34iuop8pidsy8.cloudfront.net/429fcf4a-3764-48b9-b50c-6e1afce4d6ca.png
Threat Actors: BL4CK CYB3R
Victim Country: Thailand
Victim Industry: International Trade & Development
Victim Organization: department of international trade promotion
Victim Site: ditp.go.th

44. Alleged leak of login access to BEST Inc.

Category: Initial Access
Content: The group claims to have leaked login access to BEST Inc.
Date: 2025-12-13T13:12:52Z
Network: telegram
Published URL: https://t.me/NigthCrawlerX/1295Screenshots:https://d34iuop8pidsy8.cloudfront.net/2fca9c07-67e9-4028-a685-c4d26d9f1b56.png
Threat Actors: NightCrawlerX
Victim Country: Thailand
Victim Industry: Transportation & Logistics
Victim Organization: best inc.
Victim Site: best-inc.co.th

45. INDRAMAYU CHAOS SYSTEM targets the website of Holy Family College of Health Sciences

Category: Defacement
Content: The group claims to have defaced the website of Holy Family College of Health Sciences. Mirror: https://defacer.id/mirror/id/216704
Date: 2025-12-13T13:05:22Z
Network: telegram
Published URL: https://t.me/c/3427600175/64Screenshots:https://d34iuop8pidsy8.cloudfront.net/2827033b-86d2-4539-aff3-7c6e3287c613.png
Threat Actors: INDRAMAYU CHAOS SYSTEM
Victim Country: Malawi
Victim Industry: Non-profit & Social Organizations
Victim Organization: holy family college of health sciences
Victim Site: holyfamilychs.ac.mw

46. Alleged data sale of Taiwan Personal Information

Category: Data Breach
Content: The threat actor claims to be selling 18,264 records of leaked personal information from Taiwan. The compromised data reportedly includes first name, last name, phone number, date of birth, city, street, zone, gender, and other details.
Date: 2025-12-13T12:51:05Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-18k-Taiwan-Personal-InformationScreenshots:https://d34iuop8pidsy8.cloudfront.net/f0427ab4-9b6c-4ac0-b16f-a9ee89aaee80.png
Threat Actors: socializer
Victim Country: Taiwan
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

47. Alleged data breach of APOIA.se

Category: Data Breach
Content: The threat actor claims to have breached data of 535,000 users from APOIA.se, allegedly containing user IDs, names, email addresses, postal codes, street addresses, house numbers, neighborhoods, cities, states, and more.
Date: 2025-12-13T12:47:00Z
Network: openweb
Published URL: https://darkforums.hn/Thread-DATABASE-apoia-se-databreachScreenshots:https://d34iuop8pidsy8.cloudfront.net/2be7ac79-1a91-419d-8964-ebe9f4df2964.png
Threat Actors: Real
Victim Country: Brazil
Victim Industry: Other Industry
Victim Organization: apoia.se
Victim Site: apoia.se

48. Cranford, Buckley, Schultze, Tomchin, Allen & Buie, P.A. falls victim to MintEye Ransomware

Category: Ransomware
Content: The group claims to have obtained 350 GB of the organization’s data. NB: The organization had previously fallen victim to Qilin ransomware on December 7, 2025. NB: The authenticity of the claim is yet to be verified.
Date: 2025-12-13T12:36:29Z
Network: openweb
Published URL: http://85.121.48.68/Screenshots:https://d34iuop8pidsy8.cloudfront.net/7da7e50b-6e01-4ee8-ab28-f58d3bbc0f8a.jpg
Threat Actors: MintEye
Victim Country: USA
Victim Industry: Law Practice & Law Firms
Victim Organization: cranford, buckley, schultze, tomchin, allen & buie, p.a.
Victim Site: southcharlottelawfirm.com

49. Alleged leak of U.S. database with SSNs and bank information

Category: Data Breach
Content: The threat actor claims to have leaked 1.2 million records from a U.S. database, allegedly containing SSNs and bank information.
Date: 2025-12-13T12:30:43Z
Network: openweb
Published URL: https://darkforums.hn/Thread-1-2m-USA-db-with-ssn-and-bank-infoScreenshots:https://d34iuop8pidsy8.cloudfront.net/fbdbdfe7-4f2a-45c1-8b73-854dfaf5cdd1.png
Threat Actors: gtaviispeak
Victim Country: USA
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

50. KEYLOGISTICS CHILE falls victim to MintEye Ransomware

Category: Ransomware
Content: The group claims to have obtained 1.4 TB of the organization’s data. NB: The authenticity of the claim is yet to be verified.
Date: 2025-12-13T12:15:29Z
Network: openweb
Published URL: http://85.121.48.68/Screenshots:https://d34iuop8pidsy8.cloudfront.net/a6c72af4-8b1a-46e7-a36a-e1f7b575ded9.png
Threat Actors: MintEye
Victim Country: Chile
Victim Industry: Transportation & Logistics
Victim Organization: keylogistics chile
Victim Site: keylogistics.cl

51. Alleged data breach of declaraciones.gob.mx

Category: Data Breach
Content: The threat actor claims to be selling 18,104 lines of data from declaraciones.gob.mx. The compromised data reportedly include Full Name, Personal Email + Institutional Email, Curriculum & Education History, Government Entity, Area, Function, etc.
Date: 2025-12-13T12:08:28Z
Network: openweb
Published URL: https://darkforums.hn/Thread-DATABASE-declaraciones-gob-mx-2025-18-1K-Records-Mexico-Government-Asset-BreachLabsScreenshots:https://d34iuop8pidsy8.cloudfront.net/05e58ea5-131c-43f8-888b-b13c1d4f0640.png https://d34iuop8pidsy8.cloudfront.net/28276410-1481-4592-9290-388942a608b9.png
Threat Actors: BreachLaboratory
Victim Country: Mexico
Victim Industry: Government & Public Sector
Victim Organization: Unknown
Victim Site: declaraciones.gob.mx

52. Inter-American Tropical Tuna Commission (IATTC) falls victim to MintEye Ransomware

Category: Ransomware
Content: The group claims to have obtained 2.3 TB of the organization’s data. NB: The authenticity of the claim is yet to be verified.
Date: 2025-12-13T12:06:40Z
Network: openweb
Published URL: http://85.121.48.68/Screenshots:https://d34iuop8pidsy8.cloudfront.net/9eacc60f-29ed-40bb-8aec-a91d1813fb39.png
Threat Actors: MintEye
Victim Country: USA
Victim Industry: Fishery
Victim Organization: inter-american tropical tuna commission (iattc)
Victim Site: iattc.org

53. Sponseller Group Inc falls victim to MintEye Ransomware

Category: Ransomware
Content: The group claims to have obtained 300 GB of the organization’s data. NB: The authenticity of the claim is yet to be verified.
Date: 2025-12-13T11:56:39Z
Network: openweb
Published URL: http://85.121.48.68/Screenshots:https://d34iuop8pidsy8.cloudfront.net/3983629d-55ac-43c7-9330-5e2b1f87b383.png
Threat Actors: MintEye
Victim Country: USA
Victim Industry: Civil Engineering
Victim Organization: sponseller group inc
Victim Site: sponsellergroup.com

54. David M. Schwarz Architects, Inc., falls victim to MintEye Ransomware

Category: Ransomware
Content: The group claims to have obtained 1.9 TB of the organization’s data. NB: it was previously falls victims to Qilin Ransomware on Dec 07 2025. NB: The authenticity of the claim is yet to be verified.
Date: 2025-12-13T11:47:45Z
Network: openweb
Published URL: http://85.121.48.68/Screenshots:https://d34iuop8pidsy8.cloudfront.net/dfd9181d-a928-4b0e-9dc7-3aa0c8eb7bdf.png
Threat Actors: MintEye
Victim Country: USA
Victim Industry: Architecture & Planning
Victim Organization: david m. schwarz architects, inc.
Victim Site: dmsas.com

55. Temple Shalom falls victim to DragonForce Ransomware

Category: Ransomware
Content: Group claims to have access to 92.79 GB of organization data and to publish it within the next 2–3 days.
Date: 2025-12-13T11:42:34Z
Network: tor
Published URL: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blogScreenshots:https://d34iuop8pidsy8.cloudfront.net/0dd538cd-c655-4067-8c9f-763dc03d15dc.jpg
Threat Actors: DragonForce
Victim Country: USA
Victim Industry: Non-profit & Social Organizations
Victim Organization: temple shalom
Victim Site: templeshalom.net

56. Alleged sale of Phanesware ransomware tool

Category: Malware
Content: The threat actor claims to be selling a ransomware tool called Phanesware, which reportedly features undetectable functionality, AES encryption, stealer capabilities, and backup functionality.
Date: 2025-12-13T11:38:04Z
Network: openweb
Published URL: https://darkforums.hn/Thread-THE-BEST-RANSOMWARE-PHANESWARE%F0%9F%9A%80%F0%9F%94%90Screenshots:https://d34iuop8pidsy8.cloudfront.net/219040d5-36ce-49f3-bd85-ad97726c8f4b.png https://d34iuop8pidsy8.cloudfront.net/4ade5004-7102-481b-a031-b967df17198e.png https://d34iuop8pidsy8.cloudfront.net/0cdb8188-4901-41f2-b367-781b8e5bc4c7.png https://d34iuop8pidsy8.cloudfront.net/eac792f0-600e-4b30-9cd4-fcadd2e59340.png
Threat Actors: phanes
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

57. JavaneseTeam targets the website of Digital Lisbon

Category: Defacement
Content: The group claims to have defaced the website of Digital Lisbon
Date: 2025-12-13T11:37:39Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216372Screenshots:https://d34iuop8pidsy8.cloudfront.net/f713182c-edb9-4c1c-8ae6-987afee463d2.JPG
Threat Actors: JavaneseTeam
Victim Country: Portugal
Victim Industry: Information Technology (IT) Services
Victim Organization: digital lisbon
Victim Site: digitallisbon.pt

58. Alleged breach of Thai Ministry of Finance systems

Category: Data Breach
Content: The group claims to have compromised an electronic system associated with the Thai Ministry of Finance, operated by a third-party company managing digital documents, internal emails, employee data, and internal work processes. The actors allege attacks on more than five websites over approximately three days and claim to have obtained around 468 GB of data.
Date: 2025-12-13T11:22:06Z
Network: telegram
Published URL: https://t.me/kkg_z/513Screenshots:https://d34iuop8pidsy8.cloudfront.net/76e75ad5-e315-4b31-88f4-669ff2c355e5.png
Threat Actors: KKG-Z
Victim Country: Thailand
Victim Industry: Government Administration
Victim Organization: Unknown
Victim Site: Unknown

59. Pharaoh’s Team Channel targets the website of CASABONA SILVER PALACE

Category: Defacement
Content: The group claims to have defaced the website of CASABONA SILVER PALACE
Date: 2025-12-13T11:09:32Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/459Screenshots:https://d34iuop8pidsy8.cloudfront.net/89d686af-cef1-4f49-a229-758ec06d46ab.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Chile
Victim Industry: Luxury Goods & Jewelry
Victim Organization: casabona silver palace
Victim Site: silverpalace.cl

60. LolForum targets the website of inkPOS

Category: Defacement
Content: The group claims to have defaced the website of inkPOS.
Date: 2025-12-13T11:08:39Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216335Screenshots:https://d34iuop8pidsy8.cloudfront.net/31dbaf2f-d8ed-4b51-93d4-3a8046fdd440.png
Threat Actors: LolForum
Victim Country: UK
Victim Industry: Software
Victim Organization: inkpos
Victim Site: inkpos.com

61. Cyb3r Drag0nz targets the website of World WebX

Category: Defacement
Content: The group claims to have defaced the website of World WebX
Date: 2025-12-13T11:04:36Z
Network: openweb
Published URL: https://defacer.id/mirror/id/216374Screenshots:https://d34iuop8pidsy8.cloudfront.net/3cf0ce76-a606-4da8-8a77-182f50ffe360.JPG
Threat Actors: Cyb3r Drag0nz
Victim Country: USA
Victim Industry: Media Production
Victim Organization: world webx
Victim Site: worldwebx.com

62. Alleged data breach of Deutsche Telekom AG

Category: Data Breach
Content: The group claims t have breached data from Deutsche Telekom AG.
Date: 2025-12-13T11:02:21Z
Network: telegram
Published URL: https://t.me/usersecc/601Screenshots:https://d34iuop8pidsy8.cloudfront.net/f7a47e75-b7fa-424f-b266-51bb2df89612.png https://d34iuop8pidsy8.cloudfront.net/29230801-74e1-46df-a3cf-43fe973251f0.png
Threat Actors: UserSec
Victim Country: Germany
Victim Industry: Network & Telecommunications
Victim Organization: deutsche telekom ag
Victim Site: telekom.com

63. Watermark Beach Resort falls victim to Qilin Ransomware

Category: Ransomware
Content: The group claims to have obtained organization’s data.
Date: 2025-12-13T10:49:48Z
Network: tor
Published URL: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=88e9209e-df1c-392d-97a0-02e76397cebbScreenshots:https://d34iuop8pidsy8.cloudfront.net/a8d70eeb-cc80-4524-b7e9-f599bfe38277.png
Threat Actors: Qilin
Victim Country: Canada
Victim Industry: Hospitality & Tourism
Victim Organization: watermark beach resort
Victim Site: watermarkbeachresort.com

64. Chema Ballester falls victim to Qilin Ransomware

Category: Ransomware
Content: The group claims to have obtained organization’s data.
Date: 2025-12-13T10:46:28Z
Network: tor
Published URL: http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=eb42363a-52c2-3a10-9f2f-2dde80ddf9e1Screenshots:https://d34iuop8pidsy8.cloudfront.net/fd7e1609-39c9-4580-a4b1-9def3f9bf50d.jpg
Threat Actors: Qilin
Victim Country: Spain
Victim Industry: Transportation & Logistics
Victim Organization: chema ballester
Victim Site: chemaballester.com

65. Alleged data sale of Mondi Group

Category: Data Breach
Content: Threat actor claims to be selling mail access and sensitive document from Mondi Group.
Date: 2025-12-13T10:42:10Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-Mondi-Group-Finance-Mail-Access-DocumentsScreenshots:https://d34iuop8pidsy8.cloudfront.net/f4b2bf8c-1380-45c5-b6df-9d8271cb1ed5.png
Threat Actors: phanes
Victim Country: UK
Victim Industry: Packaging & Containers
Victim Organization: mondi group
Victim Site: mondigroup.com

66. Alleged data leak of tridentcryptofund.com

Category: Data Breach
Content: The threat actor claims to have leaked 267,409 records from tridentcryptofund.com, allegedly containing email addresses, MD5 password hashes, first names, last names, country information, IP addresses, and more.
Date: 2025-12-13T10:35:21Z
Network: openweb
Published URL: https://darkforums.hn/Thread-DATABASE-tridentcryptofund-com-267K-Records-Crypto-Investment-Leak-BreachLabsScreenshots:https://d34iuop8pidsy8.cloudfront.net/49712e2f-4351-4ef2-be43-926a1fe69b24.png https://d34iuop8pidsy8.cloudfront.net/c773d1e9-e1b2-47cd-99f9-e42f992d1bca.png
Threat Actors: BreachLaboratory
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: tridentcryptofund.com

67. Pharaoh’s Team Channel targets the website of parcelasriovenado

Category: Defacement
Content: The group claims to have defaced the website of parcelasriovenado.
Date: 2025-12-13T10:34:52Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/459Screenshots:https://d34iuop8pidsy8.cloudfront.net/267e1f41-f469-4b37-92af-3b2fe243093f.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Chile
Victim Industry: Retail Industry
Victim Organization: parcelasriovenado
Victim Site: riovenado.cl

68. Alleged data breach of ASAP Services

Category: Data Breach
Content: Threat actor claims to be selling databases and files belonging to over 200 websites, allegedly stolen from the Indian web hosting and IT services provider ASAP Services. The compromised data reportedly exceeds 250 GB in total and includes more than 1 million records, as well as a 500 MB database associated with ASAP Services.
Date: 2025-12-13T10:33:54Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-INDIA-200-websites-database-leak-date-12-2025Screenshots:https://d34iuop8pidsy8.cloudfront.net/d028a2cf-f44d-4086-ae6f-2d11f40a1ce7.png
Threat Actors: nullbytes_0x00
Victim Country: India
Victim Industry: Information Technology (IT) Services
Victim Organization: asap services
Victim Site: asapservices.co.in

69. Alleged data leak of Badan Kepegawaian Negara, Indonesia

Category: Data Breach
Content: The threat actor claims to have have leaked 2,460 records from Badan Kepegawaian Negara, Indonesia, allegedly containing full name, gender, date of birth, position/job title, rank, employment type, and more. The data was reportedly leaked in January 2025.
Date: 2025-12-13T10:21:05Z
Network: openweb
Published URL: https://darkforums.hn/Thread-DATABASE-bkn-go-id-2-4K-Records-Indonesian-Civil-Service-Leak-BreachLabsScreenshots:https://d34iuop8pidsy8.cloudfront.net/438ee6ea-8cc6-403b-852c-4be309665844.png https://d34iuop8pidsy8.cloudfront.net/66715d75-daf9-4198-84fc-74059750ccbd.png
Threat Actors: BreachLaboratory
Victim Country: Indonesia
Victim Industry: Government Administration
Victim Organization: badan kepegawaian negara
Victim Site: bkn.go.id

70. Z-BL4CX-H4T claims to target multiple countries

Category: Alert
Content: A recent post by the group indicates that they are targeting multiple countries including Israel, India, UK, France, Germany, Canada, Italy.
Date: 2025-12-13T10:21:02Z
Network: telegram
Published URL: https://t.me/c/3027611821/193Screenshots:https://d34iuop8pidsy8.cloudfront.net/3c979bfd-9109-4e44-821d-78a818fe91d2.png
Threat Actors: Z-BL4CX-H4T
Victim Country: Israel
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

71. Alleged leak of Turkish Ağrı University student exam data

Category: Data Breach
Content: The threat actor claims to have leaked 81 rows of data from the Ağrı University student examination database. The compromised data reportedly includes first name, last name, gender, date of birth, education type, student number, class, and more.
Date: 2025-12-13T09:38:48Z
Network: openweb
Published URL: https://darkforums.hn/Thread-DATABASE-Turkish-A%C4%9Fr%C4%B1-University-Student-Exam-DB-LeakedScreenshots:https://d34iuop8pidsy8.cloudfront.net/e2fb8fd2-aedb-4654-a0df-9d560d664ff9.png
Threat Actors: phanes
Victim Country: Turkey
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

72. Alleged data sale of DepEd, Division of Roxas City

Category: Data Breach
Content: The threat actor claims to be selling data from the DepEd Division of Roxas City, allegedly containing fresh 2025 credentials with predictable password patterns, exposing teachers hired and registered this year, school portal access, and personal identification information.
Date: 2025-12-13T09:31:42Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-Total-System-Compromise-DataScreenshots:https://d34iuop8pidsy8.cloudfront.net/b6cd9f4a-6014-4a77-9850-0233b200b761.png
Threat Actors: TheNexusSquad
Victim Country: Philippines
Victim Industry: Education
Victim Organization: deped, division of roxas city
Victim Site: depedroxascity.com

73. Alleged data leak of mixed email list

Category: Data Breach
Content: “The threat actor claims to have leaked 91,960 email credentials, allegedly containing email addresses, passwords, first names, last names, year of birth, and age.
Date: 2025-12-13T09:31:37Z
Network: openweb
Published URL: https://darkforums.hn/Thread-91960-Email-ListScreenshots:https://d34iuop8pidsy8.cloudfront.net/25915a73-8dd2-4b17-800b-9032a4dfc1a4.png https://d34iuop8pidsy8.cloudfront.net/6faeaeaf-1128-481a-ac51-9e91e45c48e7.png
Threat Actors: phanes
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

74. Pharaoh’s Team Channel targets the website of matrimoniocaroycarlos.cl

Category: Defacement
Content: The group claims to have defaced the website of matrimoniocaroycarlos.cl
Date: 2025-12-13T09:07:01Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/459Screenshots:https://d34iuop8pidsy8.cloudfront.net/9eb2ada8-b833-4bfb-b38b-c9ed1fda21b8.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Chile
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: matrimoniocaroycarlos.cl

75. Pharaoh’s Team Channel targets the website of Fantasy Escort

Category: Defacement
Content: The group claims to have defaced the website of Fantasy Escort
Date: 2025-12-13T08:45:41Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/459Screenshots:https://d34iuop8pidsy8.cloudfront.net/bb995196-3cea-41f4-8798-a3ad353ec945.jpg
Threat Actors: Pharaoh’s Team Channel
Victim Country: Chile
Victim Industry: Entertainment & Movie Production
Victim Organization: fantasy escort
Victim Site: fantasiaescort.cl

76. Alleged leak of Turkey’s health data

Category: Data Breach
Content: The threat actor claims to have leaked 1,001 rows of data from Turkey’s health database.
Date: 2025-12-13T08:43:48Z
Network: openweb
Published URL: https://darkforums.hn/Thread-TURKEY-1000-ROWS-HEALTH-DB-LEAKED-DOWNLOADScreenshots:https://d34iuop8pidsy8.cloudfront.net/f17db6f5-56e3-4c79-8f92-5e7702674757.png
Threat Actors: phanes
Victim Country: Turkey
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

77. Pharaoh’s Team Channel targets the website of ECAIS

Category: Defacement
Content: The group claims to have defaced the website of ECAIS
Date: 2025-12-13T08:05:10Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/459Screenshots:https://d34iuop8pidsy8.cloudfront.net/f3a30473-4f93-49dd-8212-a00e285832f0.jpg
Threat Actors: Pharaoh’s Team Channel
Victim Country: Chile
Victim Industry: Music
Victim Organization: ecais
Victim Site: ecais.cl

78. Pharaoh’s Team Channel targets the website of Sólo Maskotas

Category: Defacement
Content: The group claims to have defaced the website of Sólo Maskotas.
Date: 2025-12-13T07:57:34Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/459Screenshots:https://d34iuop8pidsy8.cloudfront.net/b6e3195f-739a-42f0-9f77-90a6a3ae44b6.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Chile
Victim Industry: Consumer Goods
Victim Organization: sólo maskotas
Victim Site: solomaskotas.cl

79. Pharaoh’s Team Channel targets the websites of Apardo

Category: Defacement
Content: The group claims to have defaced the websites of Apardo.
Date: 2025-12-13T07:42:56Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/459Screenshots:https://d34iuop8pidsy8.cloudfront.net/7c61ee05-f769-4014-9361-d02b45255cdc.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Chile
Victim Industry: Business and Economic Development
Victim Organization: apardo
Victim Site: apardo.cl

80. Pharaoh’s Team Channel targets the website of Cazafugas

Category: Defacement
Content: The group claims to have defaced the website of Cazafugas
Date: 2025-12-13T07:36:10Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/459Screenshots:https://d34iuop8pidsy8.cloudfront.net/13134803-e7eb-46db-b070-05a6b5c2635c.JPG
Threat Actors: Pharaoh’s Team Channel
Victim Country: Chile
Victim Industry: Public Safety
Victim Organization: cazafugas
Victim Site: cazafugas.cl

81. Pharaoh’s Team Channel targets the website of tienminhtran.com

Category: Defacement
Content: The group claims to have defaced the website of tienminhtran.com
Date: 2025-12-13T06:27:47Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/158b3cbd-d7ec-45b2-ad92-9243b6421bb6.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: tienminhtran.com

82. Pharaoh’s Team Channel targets the website of adbreakshop.com

Category: Defacement
Content: Group claims to have defaced the website of adbreakshop.com
Date: 2025-12-13T06:17:29Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/a860eb55-ce4f-4aa9-af4e-cc74ce04c948.png https://d34iuop8pidsy8.cloudfront.net/7e6da641-15a6-4bdb-bbff-80d53854b236.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: adbreakshop.com

83. Pharaoh’s Team Channel targets the website of tphoangmai

Category: Defacement
Content: Group claims to have defaced the website of tphoangmai
Date: 2025-12-13T06:11:26Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/a4f944fe-90de-4589-ad29-da84dd9c5686.png https://d34iuop8pidsy8.cloudfront.net/75d58b01-4164-42d3-b09d-d8c960ffc6ce.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Vietnam
Victim Industry: Unknown
Victim Organization: tphoangmai
Victim Site: raovat.tphoangmai.vn

84. Alleged data leak of Hacienda Hermosillo

Category: Data Breach
Content: The threat actor claims to have leaked data from Hacienda Hermosillo, stating they accessed an interconnected system of four servers containing more than 350 GB of information. The actor alleges that only around 40 GB of data was exfiltrated due to the overall volume, but that the obtained files include sensitive materials such as source code, databases, and other internal information. NB: The authenticity of the claim is yet to be verified.
Date: 2025-12-13T06:09:29Z
Network: telegram
Published URL: https://t.me/c/3211040888/282Screenshots:https://d34iuop8pidsy8.cloudfront.net/f5cc2077-0f03-4bd6-bcf6-4a8bf7f728bd.png
Threat Actors: Chronus leaks
Victim Country: Mexico
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

85. Pharaoh’s Team Channel targets the website of saidkarout.de

Category: Defacement
Content: The group claims to have defaced the website of saidkarout.de
Date: 2025-12-13T06:00:00Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/8379a7b3-42ce-4857-85f6-4a4e5075aa24.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Germany
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: saidkarout.de

86. Pharaoh’s Team Channel targets the website of Krishna Consulting

Category: Defacement
Content: Group claims to have defaced the website of Krishna Consulting
Date: 2025-12-13T05:46:55Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/32d61356-6c2d-4059-a2ce-d22732f5723f.png https://d34iuop8pidsy8.cloudfront.net/2779295b-b573-4699-8c19-4dc2ce77a116.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: krishna consulting
Victim Site: krishnaconsulting.space

87. Pharaoh’s Team Channel targets the website of likesub.us

Category: Defacement
Content: The group claims to have defaced the website of likesub.us
Date: 2025-12-13T05:45:18Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/262da379-a874-4b9d-aa4c-3bf7aa6cdac4.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Unknown
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: likesub.us

88. Pharaoh’s Team Channel targets the website of hangcali.shop

Category: Defacement
Content: The group claims to have defaced the website of hangcali.shop
Date: 2025-12-13T05:40:23Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/3b131c43-e203-450c-b82c-757c3b518bf0.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Unknown
Victim Industry: E-commerce & Online Stores
Victim Organization: Unknown
Victim Site: hangcali.shop

89. Pharaoh’s Team Channel targets the website of Legal Questions

Category: Defacement
Content: The group claims to have defaced the website of Legal Questions.
Date: 2025-12-13T05:34:57Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/7eb63260-0b4a-42a8-9966-f8f8224a0c7f.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Vietnam
Victim Industry: Legal Services
Victim Organization: legal questions
Victim Site: cauhoiphapluat.com

90. Pharaoh’s Team Channel targets the website of Melissa’s Management & Consulting

Category: Defacement
Content: Group claims to have defaced the website of Melissa’s Management & Consulting
Date: 2025-12-13T05:27:28Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/56ef0f36-6ca2-47a1-8a77-f04996cf53e7.png https://d34iuop8pidsy8.cloudfront.net/b32ecdd6-4cd7-4560-a86d-fc4ef2184f8f.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: USA
Victim Industry: Management Consulting
Victim Organization: melissa’s management & consulting
Victim Site: melissaconsultllc.com

91. Pharaoh’s Team Channel targets the website of Vieclamday

Category: Defacement
Content: Group claims to have defaced the website of Vieclamday.
Date: 2025-12-13T05:26:04Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/62afd556-b91d-4a49-aa1c-d5450fceaa99.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Vietnam
Victim Industry: Staffing/Recruiting
Victim Organization: vieclamday
Victim Site: booking.vieclamday.com

92. Pharaoh’s Team Channel targets the website of MMoReal

Category: Defacement
Content: Group claims to have defaced the website of MMoReal.
Date: 2025-12-13T05:02:45Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/2e92b95f-cc3b-4cbc-8b34-461d07233cc8.png https://d34iuop8pidsy8.cloudfront.net/8010a09c-c5bd-474d-83f9-dbd5f10fcf67.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Vietnam
Victim Industry: Information Services
Victim Organization: mmoreal
Victim Site: mmoreal.com

93. Pharaoh’s Team Channel targets the website of ChuTro

Category: Defacement
Content: Group claims to have defaced the website of ChuTro.
Date: 2025-12-13T04:59:50Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/de680ed4-7851-484e-b19c-40c8cd99e2f1.png https://d34iuop8pidsy8.cloudfront.net/5debf655-c693-440f-9f70-cabd9ec6417c.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Vietnam
Victim Industry: Real Estate
Victim Organization: chutro
Victim Site: chutro.net

94. Alleged data sale of USA leads

Category: Data Breach
Content: Threat actor claims to be selling USA leads from multiple sources including Ledger, Binance, Coinbase, Gemini, Kraken.
Date: 2025-12-13T04:45:53Z
Network: openweb
Published URL: https://darkforums.hn/Thread-Selling-%F0%9F%87%BA%F0%9F%87%B8-SELLING-LEDGER-BINANCE-COINBASE-GEMINI-AND-KRAKEN-LEADS-%F0%9F%87%BA%F0%9F%87%B8Screenshots:https://d34iuop8pidsy8.cloudfront.net/b32b7392-cd0c-4521-bc48-812ae8da9e32.png
Threat Actors: zoozkooz
Victim Country: USA
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

95. Alleged sale of admin access to wordpress shop

Category: Initial Access
Content: Threat actor claims to be selling unauthorized admin access to unidentified wordpress shop.
Date: 2025-12-13T04:44:31Z
Network: openweb
Published URL: https://forum.exploit.biz/topic/271981/Screenshots:https://d34iuop8pidsy8.cloudfront.net/5d135c1f-c745-4727-9381-bea9cfef92ed.png
Threat Actors: corptoday
Victim Country: Unknown
Victim Industry: E-commerce & Online Stores
Victim Organization: Unknown
Victim Site: Unknown

96. Alleged data breach of Government of the State of Sonora

Category: Data Breach
Content: Group claims to have leaked 50 GB file system data of Government of the State of Sonora.
Date: 2025-12-13T04:38:03Z
Network: telegram
Published URL: https://t.me/c/3211040888/275Screenshots:https://d34iuop8pidsy8.cloudfront.net/62d591be-2955-4b72-8319-cca85528b9e4.png
Threat Actors: Chronus leaks
Victim Country: Mexico
Victim Industry: Government Administration
Victim Organization: government of the state of sonora
Victim Site: sonora.gob.mx

97. Alleged leak of login credentials to Contributor – KMUTT

Category: Initial Access
Content: The group claims to have leaked login credentials to Contributor – KMUTT
Date: 2025-12-13T04:11:37Z
Network: telegram
Published URL: https://t.me/Cyb3r_Angel/143Screenshots:https://d34iuop8pidsy8.cloudfront.net/f92b8c19-71c8-43ef-befc-e5481b91f4ce.png
Threat Actors: CYB3R ANGEL
Victim Country: Thailand
Victim Industry: Education
Victim Organization: contributor – kmutt
Victim Site: contributor.lib.kmutt.ac.th

98. Alleged leak of unauthorized login access to sqli.ssk.in.th

Category: Initial Access
Content: Threat actor claims to have leaked unauthorized login credentials to sqli.ssk.in.th
Date: 2025-12-13T04:02:09Z
Network: telegram
Published URL: https://t.me/kkg_z/495Screenshots:https://d34iuop8pidsy8.cloudfront.net/943b8aa8-e899-453f-866c-2d1341c19557.png
Threat Actors: KKG-Z
Victim Country: Thailand
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: sqli.ssk.in.th/index.php

99. Alleged sale of unauthorized login access to sqli.ssk.in.th

Category: Initial Access
Content: Threat actor claims to be selling unauthorized login credentials to sqli.ssk.in.th
Date: 2025-12-13T03:46:28Z
Network: telegram
Published URL: https://t.me/kkg_z/495Screenshots:https://d34iuop8pidsy8.cloudfront.net/943b8aa8-e899-453f-866c-2d1341c19557.png
Threat Actors: KKG-Z
Victim Country: Thailand
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: sqli.ssk.in.th/index.php

100. Alleged data leak of Israel vehicle data

Category: Data Breach
Content: Group claims to have leaked more than 1M Israel vehicle data. The compromised data includes vehicle registration and technical details such as plate number, vehicle model, model type, brand, manufacturer and model codes (cd_mn, cd_model), nicknames (nickname, nickname2), vehicle condition, safety rating, pollution group, manufacturing year, and engine model.
Date: 2025-12-13T03:43:09Z
Network: telegram
Published URL: https://t.me/ZirconGroupPublic/643Screenshots:https://d34iuop8pidsy8.cloudfront.net/c4700957-04fd-4bb9-aea2-e91b21ed89bd.png
Threat Actors: Zircon Group
Victim Country: Israel
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

101. Pharaoh’s Team Channel targets the website of Boki Now

Category: Defacement
Content: The group claims to have defaced the website of Boki Now.
Date: 2025-12-13T03:40:26Z
Network: telegram
Published URL: https://t.me/Pharaohs_n/456Screenshots:https://d34iuop8pidsy8.cloudfront.net/a0accd33-8fb0-4a0c-a925-b0bf9124ab5e.png https://d34iuop8pidsy8.cloudfront.net/02dfaecd-45fe-4e50-9176-d27cab8a0999.png
Threat Actors: Pharaoh’s Team Channel
Victim Country: Unknown
Victim Industry: Leisure & Travel
Victim Organization: boki now
Victim Site: bokinow.com

102. Alleged leak of UK citizens data

Category: Data Breach
Content: Threat actor claims to have access to 6,200 UK citizens data .The compromised data reportedly includes national insurance numbers, date of birth, address, and financial information.
Date: 2025-12-13T03:09:51Z
Network: tor
Published URL: http://763olyp74dxnq4wrzukk3dde6ffahxxjzealf3bzvdoyd7tptksxiiad.onion/Thread-CSV-6200-UK-FULLZ-Nin-Dob-Address-Financial-InfoScreenshots:https://d34iuop8pidsy8.cloudfront.net/3e83c515-3c9b-40b0-9b95-2df00aaa0d7d.png
Threat Actors: krasnov
Victim Country: UK
Victim Industry: Unknown
Victim Organization: Unknown
Victim Site: Unknown

103. INDRAMAYU CHAOS SYSTEM targets the website of Desa Sumedang Sari BMT OKU Timur

Category: Defacement
Content: The group claims to have defaced the website of Desa Sumedang Sari BMT OKU Timur
Date: 2025-12-13T03:05:29Z
Network: telegram
Published URL: https://t.me/c/3427600175/63Screenshots:https://d34iuop8pidsy8.cloudfront.net/7f6dcf05-c9f2-4252-a6bb-0c57bd60aefc.png
Threat Actors: INDRAMAYU CHAOS SYSTEM
Victim Country: Indonesia
Victim Industry: Government Administration
Victim Organization: desa sumedang sari bmt oku timur
Victim Site: sumedangsari-okut.desa.id

104. Federal Bureau of Investigation (FBI) falls victim to Obscura Ransomware

Category: Ransomware
Content: The group claims to have obtained 666.00 GB of the organization’s data and intends to publish it within 27 to 28 days.
Date: 2025-12-13T02:24:06Z
Network: tor
Published URL: http://obscurad3aphckihv7wptdxvdnl5emma6t3vikcf3c5oiiqndq6y6xad.onion/leaks/14Screenshots:https://d34iuop8pidsy8.cloudfront.net/fb61ef94-ad59-42de-a6a2-8712e309d738.png
Threat Actors: Obscura
Victim Country: USA
Victim Industry: Government Administration
Victim Organization: federal bureau of investigation (fbi)
Victim Site: fbi.gov

105. Ace Forwarding Inc. falls victim to Obscura Ransomware

Category: Ransomware
Content: The group claims to have obtained 300 GB of the organization’s data and intends to publish it within 3 to 4 days.
Date: 2025-12-13T02:18:06Z
Network: tor
Published URL: http://obscurad3aphckihv7wptdxvdnl5emma6t3vikcf3c5oiiqndq6y6xad.onion/leaks/14Screenshots:https://d34iuop8pidsy8.cloudfront.net/9dff3a82-ef53-4e98-a3a0-f3ce0d155a67.png
Threat Actors: Obscura
Victim Country: USA
Victim Industry: Transportation & Logistics
Victim Organization: ace forwarding inc.
Victim Site: aceforwarding.com

106. Alleged data breach of Yalidine Express Company

Category: Data Breach
Content: Threat actor claims to have leaked 123GB of data from Yalidine Express .The compromised data reportedly include administrative, HR, financial, operational, and extensive customer shipment records containing personally identifiable information.
Date: 2025-12-13T01:05:58Z
Network: openweb
Published URL: https://forum.exploit.in/topic/271957/Screenshots:https://d34iuop8pidsy8.cloudfront.net/ade091a1-5f0f-4858-b72a-9756a55f7dfd.png https://d34iuop8pidsy8.cloudfront.net/78a5d84e-be87-4a39-b351-c99f0eefc89e.png
Threat Actors: zestix
Victim Country: Algeria
Victim Industry: Package & Freight Delivery
Victim Organization: yalidine express
Victim Site: yalidine.com

Conclusion

The incidents detailed in this report highlight a diverse and active landscape of cyber threats. Data breaches and initial access sales are prominent, affecting various sectors from Education (e.g., Sripatum University, KidDiary School) to Government (e.g., Ministry of Interior Thailand) and Luxury Goods (PureJewels). The attacks impact countries including Thailand, France, UK, USA, and Italy. The compromised data ranges from login credentials and administrative access to personal user details and vehicle records. Beyond data compromise, the report also reveals significant ransomware activity, with groups such as Qilin and PLAY targeting organizations in Legal Services and Construction. The nature of these incidents emphasizes the critical importance of robust cybersecurity measures, including strong access controls, data protection strategies, and proactive threat intelligence to defend against a wide array of sophisticated and opportunistic attacks.

1. Alleged leak of login credentials to Sripatum University